We have a few web servers and a few database servers. To date, they've been standalone machines that are not part of a domain. The web servers don't talk to each other, and the web servers talk to the database servers via SQL Auth.
My concern with putting the machines in a domain together were
- added complexity - it's one more "thing" running, and doing "things" that could go wrong.
- risk - if a domain controller fails, am I now putting other machines at risk?
However, in certain scenarios it does seem convenient for them to be on a domain, sharing credentials. For example, if I want to give the "services" control on one machine access to another machine (because Remote Desktop craps out) I need to go in and assign privileges on multiple machines - something that I believe Active Directory and Domain Accounts set to simplify.
My question: I'm sure there are things I'm not considering here. Is there a best practice?